Appendix 



To the Statement of J. Richard Berman 
Assistant Inspector General for Audits 
U.S. Department of Homeland Security 

Summary of Material Weaknesses 
Related to FY 2002 Financial Statement Audits 



Federal Emergency Management Agency 

1 . Information security controls for FEMA's financial systems environment need 
improvement. 

Deficiencies existed in the areas of security program planning, training and 
awareness, background investigations, system certification and accreditation, 
technical vulnerabilities, terminations, service providers, and wireless 
communications. 

2. FEMA's financial system functionality needs significant improvement. 

Functionality deficiencies included: (1) inadequate accounting functionality in 
the property management system, (2) inefficient payroll processing, (3) no 
managerial cost accounting system, (4) interface problems with the HHS' funds 
disbursement system, and (5) inaccurate vendor table data leading to 
inefficiencies. 

3. FEMA must improve its financial reporting process. 

Deficiencies in FEMA's financial reporting process included: (1) significant 
delays in preparing financial statements, (2) unfinalized standard operating 
procedures for statement preparation, (3) lack of an integrated financial reporting 
process, (4) untimely close-outs for interagency agreements, (5) notable 
adjustments related to de-obligations, expense accruals, and the recording of 
disbursements as advances, and (6) inconsistent treatment of three unusual 
contingent appropriations. 

4. FEMA must improve its real and personal property system processes. 

FEMA lacked a property management system that met its accounting needs. The 
system only tracked equipment, not other types of property. The system changed 
acquisition dates for equipment upon transfer and did not link the location of 
equipment to the accounting records. FEMA did not have procedures to ensure 
proper property inventories or to ensure the consistent recording of equipment on 
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either a system or component basis. Processes to identify, value, and track 
construction in progress and deferred maintenance were not fully implemented. 

5. FEMA must improve its account reconciliation processes. 

Reconciliation deficiencies were noted in the areas of accounts payable, 
unliquidated obligations, fund balance with Treasury, the suspense fund, 
reimbursable activity, and intragovernmental balances. Deficiencies were related 
to timeliness, procedures, documentation, or consistency. 

6. FEMA must improve its accounts receivable processes. 

FEMA needed to improve its billing timeliness for certain accounts, although it 
had made progress during the year. 

Immigration and Naturalization Service 

1 . INS' information system controls need improvement. 

Deficiencies existed in the areas of access controls, audit trails, back-up 
procedures, change controls, and system software controls. 

2. INS' existing systems are not adequate to record revenue transactions in 
accordance with federal standards. 

The INS did not have a reliable system that could provide regular, timely data on 
the number and value of immigration applications and petitions received, 
completed, and pending. This information was necessary to support general 
ledger entries required for recording fee revenues that were earned when the 
related applications were completed. Instead, the INS recorded earned revenue in 
its general ledger when the fees were received. 

3. INS' processes for financial accounting and reporting need improvement. 

Due to limitations in the design and operation of its legacy financial accounting 
system, INS did not maintain integrated perpetual general ledger records for many 
key accrual balances. Instead, the INS used stand-alone systems and performed 
limited general ledger updates, or it obtained the required balances through 
manual processes and data calls and recorded "on-top" adjustments as part of the 
financial statement preparation process. Additionally, the INS did not perform 
monthly, or at a minimum, quarterly reconciliations of certain major account 
balances. 
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Transportation Security Administration 

1 . Hiring qualified personnel 

TSA had not hired sufficient accounting personnel for the Financial Reporting 
office. At the end of fieldwork, the vacancy rate in the CFO's financial 
management structure was 50 percent. 

2. Financial reporting and systems 

Personnel separations from TSA were not processed on a timely basis in the 
personnel system. Other deficiencies existed in the areas of access controls, 
security plans, and risk assessments. 

3. Property accounting and financial reporting 

TSA did not maintain complete and accurate records of its passenger and baggage 
screening equipment, and an adjustment of approximately $149 million was 
required to properly record construction in progress. 

4. Policies and procedures 

TSA did not have written accounting policies and procedures to support TSA's 
financial management and budgeting functions. Such policies and procedures 
might have prevented the following deficiencies: 

a. An adjustment of approximately $1.0 billion to accrue accounts payable 
properly for year-end. 

b. An approximate backlog of $322 million in purchase orders/obligating 
documents that were not entered into the accounting system at year-end, 
often because of incomplete and erroneous accounting information. 

c. Adjustments of $309 million and $101 million to correct for improper 
expensing of equipment meeting TSA's capitalization criteria. 

d. Untimely recording of accounts receivable for air carrier and passenger 
security fees. 

e. Lack of a process to develop appropriate disclosure information related to 
leasing arrangements when initially drafting financial statements. 

f. An adjustment of approximately $45 million to correct the expensing of a 
grant advance payment. 

TSA also did not have a process in place to monitor and evaluate its accounting 
and internal control systems to meet FMFIA reporting requirements. 
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5. Administration of screener contracts 

TSA did not have policies and procedures to provide an effective span of control 
to monitor contractor costs and performance. Contractors did not always provide 
evidence to support rates or specific cost and pricing data, nor did they always 
definitize their contracts, as required. These deficiencies left TSA vulnerable to 
inflated labor rates and other inappropriate charges. 

United States Customs Service 

1 . Customs did not adequately monitor the effectiveness of its internal controls over 
the entry duties and taxes in 2002. 

After the events of September 11, 2001, Customs suspended its Compliance 
Management program. This program evaluated Customs' risk-based approach to 
trade compliance by assessing whether revenue collections reasonably 
approximated those actually due. Without the CM program, Customs lacked an 
important internal control related to revenue collection during FY 2002. 

2. Drawback controls need to be strengthened. 

Customs' Automated Commercial System (ACS) could not perform certain 
processes that would have facilitated monitoring of the drawback program. To 
monitor the program, Customs used a risk management process to select claims 
for review. Although the process was supposed to allow for statistical projection 
of the results, personnel were allowed to reduce the random sample to a baseline 
number, thus impeding the statistical projection of results. Reconciliation 
procedures for related drawback claims also were not sufficiently comprehensive. 

3. Customs IT system logical access and software maintenance security controls 
need improvement. 

Deficiencies existed in the areas of network and host-based system configuration, 
password management practices, logical access controls, application programs, 
computer-related facilities and equipment, and software patches. These 
weaknesses put Customs at risk of unauthorized system access, modification, 
disclosure, loss, or impairment. 

4. Core financial systems need to be improved and integrated. 

Customs' core financial systems did not provide certain financial information 
necessary for managing operations. Also, they did not capture all transactions as 
they occurred during the year, did not record all transactions properly, and were 
not fully integrated. Additionally, the systems did not always provide for 
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essential controls with respect to override capabilities. As a result, extensive 
manual procedures and analyses were required to process certain routine 
transactions and prepare year-end financial statements. 
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